When Spring Session combined with Spring Security is used, timeout cannot be detected.

We are using spring-session and spring-security. The problem occured during version upgrade.

Timeout cannot be detected in version A. Previously, we have used spring-session and spring-security combination of version B.

version A spring-boot-starter-redis:2.0.4.RELEASE spring-session-data-redis:2.0.5.RELEASE

• spring-session-core: 2.0.5.RELEASE spring-security-web:5.0.7.RELEASE

version B spring-boot-starter-redis:1.5.7.RELEASE spring-session: 1.3.1.RELEASE spring-security-web: 4.2.4.RELEASE

In version B, SessionManagementFilter.dofilter() of Spring Security was able to detect the timeout but, timeout cannot be detected in version A.

SessionManagementFilter.dofilter()

                if (request.getRequestedSessionId() != null
                        && !request.isRequestedSessionIdValid()) {
                    if (logger.isDebugEnabled()) {
                        logger.debug("Requested session ID "
                                + request.getRequestedSessionId() + " is invalid.");
                    }

                    if (invalidSessionStrategy != null) {
                        invalidSessionStrategy
                                .onInvalidSessionDetected(request, response);
                        return;
                    }
                }

We think that the return value of request.getRequestedSessionId() is different for each version. ※SessionRepositoryFilter$SessionRepositoryRequestWrapper.getRequestedSessionId()

version A : null version B : session ID

Does it work as planned ? Could you tell me how to detect the timeout ?

[btkukinom]

Sorry for being late.

I was able to confirm that it works well. Thank you very much.

[vpavic]

Thanks for following up @btkukinom!